NBC 10 I-Team: How safe is your vote?

With the midterm elections just days away, the U.S. Department of Homeland Security said dozens of states are being actively targeted by hackers, with attempts reported as recently as last week.

What is Rhode Island doing to secure your vote? The NBC 10 I-Team went behind the scenes during the state’s primary election in September, tracking ballots from start to finish.

"There's not one thing that we are doing that will protect the entire election,” said Secretary of State Nellie Gorbea. “What we've done instead is a series of checks and balances."

One of the most important checks in that system is paper ballots, Gorbea said.

After Rhode Islanders mark their ballots with a pen inside polling places, the ballots are scanned into a computer to be counted electronically. Results are tabulated on a USB drive inside each scanning machine that’s taken to the Board of Elections after polls close.

But the paper ballots themselves are preserved. They are transported back to the boards of canvassers in each city or town, where they’re stored under lock and key for 22 months following an election.

"I would be highly concerned with any election system, at this point, that is only digital,” Gorbea said.

Cybersecurity experts agree.

"I think our electoral system as a whole is still very vulnerable to manipulation, alteration and influence from the outside,” professor Francesca Spidalieri of Salve Regina University told the I-Team.

Rhode Island and a majority of states have a paper ballot back-up system, but five states -- Louisiana, Georgia, South Carolina, New Jersey and Delaware -- use entirely electronic voting without a paper record, according to the non-partisan group, Verified Voting. That’s something Spidalieri said makes them especially vulnerable.

“There are multiple eyes looking on those states,” Spidalieri said. “I think they know that there is a big target on their back.”

At least nine other states use a paper back-up in only some areas, but not statewide, according to Verified Voting.

"There would be no independent way to audit those individual votes and there would be no way to prove with absolute certainty that the votes were properly cast,” Spidalieri said.

Another safeguard is making sure voter registration databases are accurate and secure.

In 2017, Gorbea said about 150,000 people listed on Rhode Island’s voter rolls had either moved out of state or died. NBC 10 asked her what’s been done to fix that.

“We've removed 89,000 legally, in accordance with federal law and state law,” Gorbea said. “We have another 48,000 and change that are in the inactive list. If they don't vote over the next two elections, we will be removing them as well."

But what happens if online registration records are changed not by election officials -- but by hackers? Federal officials say 21 states had their voting systems targeted in 2016 alone.

"Those are usually our weakest link, the low-hanging fruit,” Spidalieri said. “That would actually be a lot easier than hacking into voting machines because most voter registration databases are connected to the internet."

Spidalieri said hacking attempts, or “pings,” of state voter databases, are similar to a burglar casing a house, looking for the easiest way to break in. While the Department of Homeland Security reported multiple such attempts across the country in October, Gorbea’s office told NBC 10 that Rhode Island was not one of the targets.

Rhode Island will soon become one of only two states to take another step post-election, by doing what’s known as a risk-limiting audit beginning in 2020. It’s something the non-partisan group Common Cause Rhode Island pushed for starting in 2013.

“These audits are the most sophisticated available,” Common Cause Executive Director John Marion told NBC 10. “They are the only ones that provide a statistical measure of confidence that the election yielded the correct result. We're now a leader on this issue -- something you don't hear every day about Rhode Island.”